CVE-2025-62193 — NOAA PMEL Live Access Server (LAS) PyFerret command injection
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN …
Published: 2026-01-15 · CVSS: 9.3 · CVSS 4.0
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7